Text widget adds extra slashes when edited by someone without the unfiltered_html capability

[jamescollins]

(This bug was ​originally identified in WordPress Mu)

In [10802], the stripslashes() call was removed from the text widget:

$text = stripslashes(wp_filter_post_kses( $widget_text['text'] ));

changed to:

$instance['text'] = wp_filter_post_kses( $new_instance['text'] );

This bug will only affect users without the unfiltered_html capability.

In WP, admins and editors have this capability by default, so this bug hasn't been noticed.

In WPMU, users don't have the unfiltered_html capability (except site admins) so this causes extra slashes to be added when editing a text widget.

​Donncha has just checked in a change in WPMU, and I think this change should be applied to WP as well.

You can see ​here that the wp_filter_post_kses() function adds slashes. So logically whenever this function is used, stripslashes() needs to be used as well.

If you remove the unfiltered_html capability from the administrator user role (using role manager or similar), you will see that when editing a text widget, the extra slashes are added.

[jamescollins]

Patch against trunk r11784

[jamescollins]

Simple patch attached.

[azaozz]

Yes, this is WPMU specific since in WP only administrators can configure widgets and they have 'unfiltered_html' cap. so kses is never run there.

[azaozz]

(In [11794]) Strip slashes in the text widget for users without the unfiltered_html capability, props jamescollins, fixes #10563

[Denis-de-Bernardy]

The patch that got applied seems wrong. wp_filter_post_kses() expects slashed data, and we're feeding it unslashed data.

[azaozz]

As this affects mostly WPMU, perhaps add comment on the ticket there (referenced above).

[jamescollins]

Replying to Denis-de-Bernardy:

The patch that got applied seems wrong. wp_filter_post_kses() expects slashed data, and we're feeding it unslashed data.

The logic for my patch was taken from [10802]. If you look this changeset, line 403 (in r10801) was effectively replaced with line 354 (in r10802).

According to ​http://core.trac.wordpress.org/browser/trunk/wp-includes/kses.php#L1064, the wp_filter_post_kses() function strips slashes, KSES filters, then adds the slashes again.

The change in WPMU has been running on our WPMU installs for a few weeks and it seems to have fixed the problem.

[Denis-de-Bernardy]

Replying to jamescollins:

The change in WPMU has been running on our WPMU installs for a few weeks and it seems to have fixed the problem.

try feeding it stuff with a backslash... the correct patch is to:

stripslashes(wp_filter_post_kses(addslashes(...)))

[azaozz]

(In [12364]) Fix slashes in the Text widget, props Denis-de-Bernardy, fixes #10563